> ## Documentation Index > Fetch the complete documentation index at: https://docs.neo.projectdiscovery.io/llms.txt > Use this file to discover all available pages before exploring further. # List the Triage queue > List the findings of every active source of your team (HackerOne, GitHub, Security Inbox and custom API sources) that you can see, with filters, views, sorts and cursor pagination. Each finding carries its server-computed stage and effective severity. A cursor is bound to the sort and filters it was issued for: reusing it with other ones returns 400 invalid_cursor. `include=counts` adds the counts per view, stage, source, severity and SLA, read in the same snapshot as the page. Each facet ignores its own filter and applies the others. ## OpenAPI ````yaml /openapi/neo.public.openapi.json get /api/v1/triage/findings openapi: 3.1.0 info: contact: name: ProjectDiscovery url: https://neo.projectdiscovery.io description: Neo API Server - Security agent orchestration platform license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0 title: Neo API version: 1.0.0 servers: - description: Production url: https://neo.api.projectdiscovery.io - description: Development url: https://neo.api.dev.projectdiscovery.io - description: Local development url: http://localhost:8080 security: [] tags: - description: Task execution and management name: Tasks - description: Agent listing and management name: Agents - description: Public agent directory name: Agent Directory - description: User file storage management name: Files - description: User working memory management name: Memory - description: Scheduled and recurring task management name: Schedules - description: Knowledge base and semantic search name: Knowledge - description: Encrypted user credentials and API keys name: Secrets - description: Neo API key management for programmatic access name: API Keys - description: User profile and account information name: User - description: Task and LLM usage tracking name: Usage - description: Bring Your Own Key provider management name: BYOK - description: Connect personal AI provider accounts and select them as a model source name: AI Connections - description: Model discovery and capabilities name: Models - description: Third-party integrations name: Integrations - description: Skill knowledge documents for agent prompts name: Skills - description: User-authored tools and toolkit management name: Dynamic Tools - description: Team management and member invitations name: Teams - description: Prompt library management and discovery name: Prompts - description: Slack bot integration for workspace installation and OAuth name: Slack - description: GitHub integration for PR reviews and repository management name: GitHub - description: Vulnerability issue tracking and management name: Issues - description: Subscription billing and plans name: Billing - description: Project management and member assignments name: Projects - description: SSH key pair generation and management for remote server access name: SSH Keys - description: Codebase structural analysis and mapping name: Codemaps - description: AI-generated codebase documentation and security analysis name: CodeWiki - description: Captured HTTP traffic query and replay name: Network Events - description: User and team API activity metadata name: Audit Logs - description: Vulnerability triage for HackerOne, GitHub, and Security Inbox name: Triage paths: /api/v1/triage/findings: get: tags: - Triage summary: List the Triage queue description: > List the findings of every active source of your team (HackerOne, GitHub, Security Inbox and custom API sources) that you can see, with filters, views, sorts and cursor pagination. Each finding carries its server-computed stage and effective severity. A cursor is bound to the sort and filters it was issued for: reusing it with other ones returns 400 invalid_cursor. `include=counts` adds the counts per view, stage, source, severity and SLA, read in the same snapshot as the page. Each facet ignores its own filter and applies the others. operationId: get-v1-triage-findings parameters: - description: Only findings of these sources (repeat the parameter for several). explode: true in: query name: source_id required: false schema: items: format: uuid type: string maxItems: 50 type: array style: form - description: Only findings of sources of these kinds. explode: true in: query name: source_kind required: false schema: items: $ref: '#/components/schemas/TriageSourceKind' maxItems: 4 type: array style: form - description: > Only findings of these accounts within a source (a HackerOne program, a GitHub repository, a mailbox), compared without case. explode: true in: query name: context required: false schema: items: maxLength: 256 type: string maxItems: 50 type: array style: form - description: > A saved view of the queue. `all`: findings that are not closed. `needs_decision`: untriaged or verdict ready with no decision. `critical_high`: open findings whose effective severity is critical or high. `in_fix`: accepted findings being fixed. `waiting`: open findings older than 7 days. `snoozed`: findings with an active snooze. Omit to list every stage. in: query name: view required: false schema: enum: - all - needs_decision - critical_high - in_fix - waiting - snoozed type: string - description: Only findings in these stages. explode: true in: query name: stage required: false schema: items: enum: - untriaged - investigating - verdict_ready - in_fix - closed type: string maxItems: 5 type: array style: form - description: > Only findings whose effective severity (override, then the latest valid run, then the source) is one of these; `none` also matches an unknown severity. explode: true in: query name: severity required: false schema: items: enum: - critical - high - medium - low - none type: string maxItems: 5 type: array style: form - description: >- Only findings whose status at the source is one of these, compared without case. explode: true in: query name: state required: false schema: items: maxLength: 128 type: string maxItems: 20 type: array style: form - description: Search in the title and the external key, without case. in: query name: q required: false schema: maxLength: 200 type: string - description: > `updated` (default): most recently changed first. `priority`: effective severity, then the oldest first. `newest` and `oldest`: by age, the report date at the source when known, else the first time Neo saw the finding. in: query name: sort required: false schema: default: updated enum: - updated - priority - newest - oldest type: string - description: > Include findings with an active snooze in the other views and filters. The snoozed view always lists them, and needs_decision never does (a snooze is a decision until it expires). in: query name: include_snoozed required: false schema: default: false type: boolean - description: > `counts` adds the queue counts to the response (computed in the same snapshot as the page). explode: true in: query name: include required: false schema: items: enum: - counts type: string maxItems: 1 type: array style: form - $ref: '#/components/parameters/TriageFindingArchived' - $ref: '#/components/parameters/TriageFindingCursor' - $ref: '#/components/parameters/TriageFindingLimit' responses: '200': content: application/json: schema: $ref: '#/components/schemas/TriageFindingListResponse' description: One page of findings '400': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: > Invalid cursor, or a cursor issued for another sort or other filters (invalid_cursor), an unknown filter value (invalid_filter), or you are not a member of a team '401': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Authentication required '500': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unexpected server error '503': $ref: '#/components/responses/TriageSourcesUnavailable' security: - BearerAuth: [] - ApiKeyAuth: [] components: schemas: TriageSourceKind: description: > hackerone, github and gmail are built-in connections; custom_api is a source you configure. enum: - hackerone - github - gmail - custom_api type: string x-enum-varnames: - TriageSourceKindHackerone - TriageSourceKindGithub - TriageSourceKindGmail - TriageSourceKindCustomApi TriageFindingListResponse: properties: count: description: Number of findings that match the filters (all pages). format: int64 type: integer counts: $ref: '#/components/schemas/TriageFindingCounts' findings: items: $ref: '#/components/schemas/TriageFinding' type: array next_cursor: description: Pass as `cursor` to read the next page. Null on the last page. nullable: true type: string required: - findings - count type: object ErrorResponse: properties: code: description: > Stable machine-readable error code — branch on this rather than matching the human `error`/`message` strings. `access_restricted` (HTTP 403) denies hosted Neo access under the access policy. On team invitations, param=email identifies a restricted recipient rather than the caller; show the error without redirecting the caller. Domain codes include `user_spending_cap_reached`, `project_spending_cap_reached`, and `insufficient_neo_credits`; Free/usage codes include `free_grant_challenge_required`, `free_usage_exhausted`, `free_task_budget_exhausted`, `model_not_available_on_free`, `sandbox_not_available_on_free` (cloud sandbox surfaces are not available on the Free plan; task files remain available from the task), `free_cannot_continue_managed_task` (a task that ran on the standard cloud sandbox cannot be continued on the Free plan; start a new task), `free_origin_not_supported` (integration-originated tasks are not available on the Free plan), `weekly_usage_limit_reached`, `billing_period_usage_limit_reached`, `topup_required`, `subscription_required`, and `isolated_workspace_purged`. Otherwise it mirrors the error kind (e.g. `forbidden`, `invalid_request`, `not_exists`, `already_exists`). example: user_spending_cap_reached type: string error: example: Bad request type: string error_id: description: Correlation id for a specific error instance, when present. type: string kind: description: Coarse error category (e.g. "forbidden request", "invalid request"). example: forbidden request type: string message: description: | Human-readable detail (the kind prefixed to the error). For display, not for branching. type: string param: description: >- Field rejected by the policy; email for a restricted invite recipient. type: string turnstile_site_key: description: | Public Cloudflare Turnstile site key returned only with `free_grant_challenge_required`, so the client can complete the invisible verification before retrying the request. type: string required: - error type: object TriageFindingCounts: description: > The queue counts, read in the same snapshot as the page. Each facet ignores its own filter and applies the others; open means a stage other than closed. properties: partial: description: > True when your team has more restricted GitHub repositories than one list checks, so some unpublished advisories are left out. type: boolean severities_open: $ref: '#/components/schemas/TriageFindingSeverityCounts' sla: description: > Open findings past their SLA target and due within 7 days, per effective severity, against the team's SLA days (defaults: critical 7, high 14, medium 30, low 90). Age is the report date at the source when known, else the first time Neo saw the finding. properties: due_7d: $ref: '#/components/schemas/TriageFindingSeverityCounts' past: $ref: '#/components/schemas/TriageFindingSeverityCounts' required: - past - due_7d type: object sources: description: Findings per source, with every filter except the source filters. items: properties: open: format: int64 type: integer source_id: format: uuid type: string total: format: int64 type: integer required: - source_id - open - total type: object type: array stages: description: Findings per stage, with every filter except the stage. properties: closed: format: int64 type: integer in_fix: format: int64 type: integer investigating: format: int64 type: integer untriaged: format: int64 type: integer verdict_ready: format: int64 type: integer required: - untriaged - investigating - verdict_ready - in_fix - closed type: object total_open: description: Open findings that match every filter except the view. format: int64 type: integer views: description: Findings per view, with every filter except the view. properties: all: format: int64 type: integer critical_high: format: int64 type: integer in_fix: format: int64 type: integer needs_decision: format: int64 type: integer snoozed: format: int64 type: integer waiting: format: int64 type: integer required: - all - needs_decision - critical_high - in_fix - waiting - snoozed type: object required: - total_open - views - stages - sources - severities_open - sla - partial type: object TriageFinding: description: > A normalized report of one source (HackerOne report, GitHub security advisory, Security Inbox thread or custom API source record). Its id is opaque; (source, external_key) is its identity at the source. properties: archived_at: format: date-time nullable: true type: string context: description: > Scope at the source: HackerOne program handle, GitHub owner/repo, or Security Inbox mailbox email. Empty for custom API sources. type: string description: type: string effective_severity: description: > The severity your team works with: the review's severity override, else the severity of the latest triage run with a valid verdict, else the source severity. enum: - none - low - medium - high - critical - unknown type: string x-enum-varnames: - TriageFindingEffectiveSeverityNone - TriageFindingEffectiveSeverityLow - TriageFindingEffectiveSeverityMedium - TriageFindingEffectiveSeverityHigh - TriageFindingEffectiveSeverityCritical - TriageFindingEffectiveSeverityUnknown external_key: description: > The record's identity at the source: HackerOne report id, GitHub security advisory id, Gmail thread id, or the mapped key of a custom API source record. type: string first_seen_at: format: date-time type: string id: format: uuid type: string last_seen_at: format: date-time type: string latest_retest: allOf: - $ref: '#/components/schemas/TriageFindingRun' description: The newest retest run of the fix. Null when none exists. nullable: true latest_run: allOf: - $ref: '#/components/schemas/TriageFindingRun' description: > The newest triage run of this finding (a triage or auto triage run, never a retest). Null when none exists. nullable: true raw: additionalProperties: true description: > The bounded source record (at most 64 KiB) as stored. Only returned by the single-finding read. Never contains credentials. nullable: true type: object removed_at: description: > When the source stopped listing the record. Only a reviewed finding is returned after that, with stage closed. format: date-time nullable: true type: string reporter: type: string review: allOf: - $ref: '#/components/schemas/TriageFindingReview' description: Your team's review of this finding. Null when nobody reviewed it. nullable: true revision: description: Increases when the source record's content changes. type: integer severity: enum: - none - low - medium - high - critical - unknown type: string x-enum-varnames: - TriageFindingSeverityNone - TriageFindingSeverityLow - TriageFindingSeverityMedium - TriageFindingSeverityHigh - TriageFindingSeverityCritical - TriageFindingSeverityUnknown source_created_at: description: When the source created the record, when the source reports it. format: date-time nullable: true type: string source_id: format: uuid type: string source_kind: $ref: '#/components/schemas/TriageSourceKind' source_name: type: string source_status: description: The record's status at the source, as the source reports it. type: string stage: $ref: '#/components/schemas/TriageFindingStage' title: type: string url: type: string required: - id - source_id - source_kind - source_name - external_key - title - description - severity - source_status - url - reporter - context - revision - first_seen_at - last_seen_at - stage - effective_severity type: object TriageFindingSeverityCounts: description: A number of findings per effective severity (`none` includes unknown). properties: critical: format: int64 type: integer high: format: int64 type: integer low: format: int64 type: integer medium: format: int64 type: integer none: format: int64 type: integer required: - critical - high - medium - low - none type: object TriageFindingRun: description: One triage run of a finding. Runs are append-only. properties: completed_at: format: date-time nullable: true type: string created_at: format: date-time type: string error_code: description: Stable failure code when status is failed, such as enqueue_failed. nullable: true type: string finding_id: format: uuid type: string finding_revision: description: The finding revision this run triages. type: integer id: format: uuid type: string internal_summary: nullable: true type: string kind: description: > triage for a run a member started, auto for an auto triage run, retest for a retest of the fix of an accepted finding. enum: - triage - auto - retest type: string x-enum-varnames: - TriageFindingRunKindTriage - TriageFindingRunKindAuto - TriageFindingRunKindRetest model: description: Model requested for the run. Empty means the default. type: string retest_outcome: description: The outcome of a retest run. Null for other runs. enum: - fixed - not_fixed - blocked nullable: true type: string x-enum-varnames: - TriageFindingRunRetestOutcomeFixed - TriageFindingRunRetestOutcomeNotFixed - TriageFindingRunRetestOutcomeBlocked status: enum: - queued - running - completed - failed - cancelled type: string x-enum-varnames: - TriageFindingRunStatusQueued - TriageFindingRunStatusRunning - TriageFindingRunStatusCompleted - TriageFindingRunStatusFailed - TriageFindingRunStatusCancelled suggested_response: nullable: true type: string task_id: description: Neo task id of this run once dispatched. format: uuid nullable: true type: string task_status: description: Current Neo task status, when the run has a task. enum: - pending - active - completed - error - aborted - suspended nullable: true type: string x-enum-varnames: - TriageFindingRunTaskStatusPending - TriageFindingRunTaskStatusActive - TriageFindingRunTaskStatusCompleted - TriageFindingRunTaskStatusError - TriageFindingRunTaskStatusAborted - TriageFindingRunTaskStatusSuspended triage_severity: description: Neo suggested severity. Only set when triage_status is valid. enum: - none - low - medium - high - critical - unknown nullable: true type: string x-enum-varnames: - TriageFindingRunTriageSeverityNone - TriageFindingRunTriageSeverityLow - TriageFindingRunTriageSeverityMedium - TriageFindingRunTriageSeverityHigh - TriageFindingRunTriageSeverityCritical - TriageFindingRunTriageSeverityUnknown triage_status: description: Neo disposition. Null until the run records a decision. enum: - valid - need_more_info - duplicate - informative - not_applicable - spam - unknown nullable: true type: string x-enum-varnames: - TriageFindingRunTriageStatusValid - TriageFindingRunTriageStatusNeedMoreInfo - TriageFindingRunTriageStatusDuplicate - TriageFindingRunTriageStatusInformative - TriageFindingRunTriageStatusNotApplicable - TriageFindingRunTriageStatusSpam - TriageFindingRunTriageStatusUnknown required: - id - finding_id - finding_revision - status - model - created_at - kind type: object TriageFindingReview: description: > Your team's review of one finding. `decision` is read at request time: a snooze that has ended reads as no decision. properties: decided_at: description: When the current decision was made. format: date-time nullable: true type: string decided_by_email: description: >- Email of the member who made the current decision. Null when that member's account was deleted. nullable: true type: string decision: description: >- The active decision. Null without a decision or after a snooze ended. enum: - accepted - duplicate - declined - snoozed nullable: true type: string x-enum-varnames: - TriageFindingReviewDecisionAccepted - TriageFindingReviewDecisionDuplicate - TriageFindingReviewDecisionDeclined - TriageFindingReviewDecisionSnoozed decline_reason: description: Why the finding was declined. enum: - false_positive - accepted_risk - wont_fix nullable: true type: string x-enum-varnames: - TriageFindingReviewDeclineReasonFalsePositive - TriageFindingReviewDeclineReasonAcceptedRisk - TriageFindingReviewDeclineReasonWontFix duplicate_of: description: The finding this one duplicates. format: uuid nullable: true type: string duplicate_of_title: description: > Title of the duplicate target. Null when you cannot see the target's source. nullable: true type: string fix: allOf: - $ref: '#/components/schemas/TriageFindingReviewFix' description: Null when the finding has no fix record. nullable: true note: description: Note of the current decision. nullable: true type: string severity_override: description: >- Severity your team set. It wins over the source and run severity until it is cleared. enum: - none - low - medium - high - critical nullable: true type: string x-enum-varnames: - TriageFindingReviewSeverityOverrideNone - TriageFindingReviewSeverityOverrideLow - TriageFindingReviewSeverityOverrideMedium - TriageFindingReviewSeverityOverrideHigh - TriageFindingReviewSeverityOverrideCritical snoozed_until: description: When the snooze ends. format: date-time nullable: true type: string updated_at: description: When the review last changed. format: date-time nullable: true type: string version: description: > Increases with every change. Send it as expected_version of the next change; 0 means the finding has no review yet. type: integer required: - version type: object TriageFindingStage: description: > Where the finding is in triage, computed by Neo from the source state, your team's review and the latest triage run: closed when the source closed it, the fix is fixed, it was declined or marked duplicate, or the source no longer lists a reviewed finding; in_fix when accepted; investigating while a run is queued or running; verdict_ready when a run ended; untriaged otherwise. A snooze does not change the stage. enum: - untriaged - investigating - verdict_ready - in_fix - closed type: string x-enum-varnames: - TriageFindingStageUntriaged - TriageFindingStageInvestigating - TriageFindingStageVerdictReady - TriageFindingStageInFix - TriageFindingStageClosed TriageFindingReviewFix: description: The fix record of an accepted finding. properties: evidence: description: Evidence given when the fix was marked fixed. nullable: true type: string fixed_at: description: When the fix was marked fixed. format: date-time nullable: true type: string note: description: Note on the fix. nullable: true type: string pr_url: description: Pull request of the fix (HTTPS). nullable: true type: string repository_url: description: Repository of the fix (HTTPS). nullable: true type: string retest_run_id: description: The retest run that set the fix to retesting. format: uuid nullable: true type: string status: description: retesting while a retest run of the fix is active. enum: - in_progress - waiting_for_pr - pr_linked - retesting - fixed nullable: true type: string x-enum-varnames: - TriageFindingReviewFixStatusInProgress - TriageFindingReviewFixStatusWaitingForPr - TriageFindingReviewFixStatusPrLinked - TriageFindingReviewFixStatusRetesting - TriageFindingReviewFixStatusFixed target_url: description: The staging target a retest checks. nullable: true type: string type: object parameters: TriageFindingArchived: description: > True lists only archived findings, false only active ones. Omit to list both. in: query name: archived required: false schema: type: boolean TriageFindingCursor: description: The next_cursor of the previous page. in: query name: cursor required: false schema: maxLength: 200 minLength: 1 type: string TriageFindingLimit: description: Maximum number of findings. Defaults to 50. in: query name: limit required: false schema: default: 50 maximum: 100 minimum: 1 type: integer responses: TriageSourcesUnavailable: content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: >- This deployment has no custom source tables yet: its database migration has not run (custom_sources_unavailable). Retry later. securitySchemes: BearerAuth: bearerFormat: JWT description: JWT authentication token scheme: bearer type: http ApiKeyAuth: description: Neo API key (neo_sk_* prefix) in: header name: X-Api-Key type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.